I am guessing that this is a message from syslog originally Check the Agent field of the event and see if it is zensyslog.

One of the unfortunate things about syslog is that there are lots of different "standards" about the format of a syslog message. What sort of device does this message originate from

If you have my "Event Management for Zenoss Core 4" paper then have a look on page 43, figure 19, that tries to explain how SyslogProcessing.py tries to decode the incoming native syslog event. Basically there are a bunch of regular expresions that match the various known syslog formats. Your SyslogProcessing.py may be slightly different as Zenoss tends to update this file with extra regular expressions as problems like yours are reported back to them.

You need to create am an entry in SyslogProcessing.py that matches your original syslog message and parses things out into their correct components. Make sure you backup that file before editing it. You might use a Python Regex tool to help you - I use http://www.pythonregex.com/ .

Once you have a regex that works, you will need to stop and start zenhyb, zopectl and zensyslog.

Cheers,

Jane

Email: jane.curry@skills-1st.co.uk    Web: https://www.skills-1st.co.uk